SANS ISC InfoSec Forums

The Zero Day Initiative has published a new and unpatched IE 0-Day that was originally reported to them (and by extension, Microsoft) in October 2013. In essence, a victim has to go to a crafted webpage that takes advantage of handling of CMarkup objects which ultimately can be used to execute code with the permissions of the web browser process. Microsoft says the EMET will mitigate this vulnerability and at least Tipping Point claims protection with their devices. At this point, there is no indication that it is being used in the wild. The interesting thing here is the timeline between initial report and there being no patch.

What this shows is.... responsible disclosure still doesn't work, especially with Microsoft and Internet Explorer. If responsible disclosure hadn't failed miserably, then this wouldn't be a zero day.

Their reputation precedes them: I am afraid little has changed since the Windows 2000/IE5 days. Never heard of a Firefox or Chrome vulnerability that was reported and the vendor chose to leave unaddressed so long....